Linux Monitoring: Best Tools for System Monitoring

Introduction / Why This Is Needed

Linux monitoring is a fundamental practice for any system administrator or developer working with servers. It allows you to promptly detect rising load, disk space exhaustion, or memory leaks before they lead to service downtime.

In this guide, you will become familiar with the main categories of monitoring tools, learn how to install them, and start using them for system performance diagnostics. We will cover both console utilities and web interfaces that work on most distributions.

After completing this guide, you will be able to:

• Quickly assess system status using top/htop.
• Analyze detailed statistics for CPU, memory, disks, and network.
• Collect historical data for post-mortem analysis.

Requirements / Preparation

Before you begin, ensure that:

1. You have access to a Linux server or virtual machine with sudo privileges (some commands require root).
2. A package manager is installed (apt for Debian/Ubuntu, yum/dnf for RHEL/CentOS).
3. For web interfaces (like netdata), the corresponding port (default 19999) must be open in the firewall.

All commands in this guide assume the use of bash or a compatible shell.

Categories of Monitoring Tools

Tools are divided into several logical groups:

1. System — show CPU load, memory usage, processes (top, htop, glances).
2. Disk — track space usage, I/O (df, iostat, nmon).
3. Network — analyze traffic, connections (netstat, ss, iftop, nethogs).
4. Logs — monitor system and application logs (journalctl, tail, lnav).
5. Comprehensive (Web Interface) — aggregate all metrics in one place with graphs (netdata, Prometheus + Grafana).

We will focus on the most popular and versatile utilities from the first four categories, as well as netdata as an example of an out-of-the-box solution.

Step 1: Installing and Using System Monitors

Installing htop (Recommended)

htop is an enhanced version of top with a color interface, mouse support, and more convenient navigation.

For Ubuntu/Debian:

sudo apt update
sudo apt install htop

For CentOS/RHEL 8+:

sudo dnf install htop

Launch and control:

htop

• F10 — exit.
• F6 — sort by selected column (e.g., %CPU).
• F9 — kill a process (select a process, press F9, then 9 for SIGKILL).
• P, M, T — sort by CPU, memory, time respectively.

💡 Tip: In htop, you can add additional columns (press F2 → Columns). For example, IO_RATE for I/O.

Using glances (Alternative)

glances is a cross-platform monitor that shows not only local but also remote metrics (via SSH or web interface).

Installation:

# Via pip (preferred for the latest version)
sudo pip3 install glances

# Or from the repository
sudo apt install glances  # Ubuntu
sudo dnf install glances  # CentOS

Launch in web mode:

glances --web

Then open http://your_server:61208 in your browser. The interface updates in real-time.

Step 2: Monitoring Disks and I/O

nmon — a universal tool for data collection

nmon (Nigel's Monitor) is a utility that simultaneously displays information about CPU, memory, disks, network, and even top processes. Its key feature is the ability to record data to a file for later analysis.

Installation:

# Ubuntu/Debian
sudo apt install nmon

# CentOS/RHEL
sudo yum install nmon

Launch:

nmon

After launching, press:

• c — CPU.
• m — memory.
• d — disks.
• n — network.
• t — top processes.
• q — exit.

Recording a session to a file:

nmon -f -s 2 -c 30

Flags:

• -f — write to file (default nmon_date_time).
• -s 2 — data collection interval of 2 seconds.
• -c 30 — number of records (30), after which the program will exit.

The file can be viewed later with nmon (just specify the path) or converted to CSV for Excel.

iostat for detailed disk statistics

iostat is part of the sysstat package. It shows disk load (await, util%) and device details.

Install sysstat:

sudo apt install sysstat  # Ubuntu
sudo dnf install sysstat  # CentOS

Command:

iostat -dx 2 5

Output:

• %util — percentage of time the disk is busy with operations. A value >80% indicates a bottleneck.
• await — average operation wait time (ms). High values indicate a problem.

Step 3: Network Monitoring

iftop — real-time traffic per interface

iftop shows which connections are consuming bandwidth in real time.

Installation:

sudo apt install iftop  # Ubuntu
sudo dnf install iftop  # CentOS

Launch:

sudo iftop -i eth0

Replace eth0 with your interface (ip a to view). Keys:

• p — pause.
• n — toggle name resolution (speeds up output).
• s — sort by source.
• d — sort by destination.

⚠️ Important: iftop requires root privileges to capture packets.

nethogs — traffic by process

The uniqueness of nethogs is that it shows which process is generating network traffic.

Installation:

sudo apt install nethogs  # Ubuntu
sudo dnf install nethogs  # CentOS

Launch:

sudo nethogs

Output:

PID   USER      PROGRAM                     DEV        SENT      RECEIVED
1234  root      /usr/lib/firefox/firefox    eth0       1.23 KB   4.56 KB

Ideal for finding "greedy" processes.

Step 4: Comprehensive Monitoring with netdata

Netdata is an out-of-the-box solution with a web interface that collects thousands of metrics and builds beautiful graphs. Installation takes a minute.

Installation (automated script):

bash <(curl -Ss https://my-netdata.io/kickstart.sh)

The script will detect your distribution and install all dependencies.

Access: After installation, open http://your_server:19999 in your browser. You will see a dashboard with:

• CPU, memory, disk, network load.
• Top processes by CPU/RAM.
• Metrics for Docker, MySQL, Nginx (if installed).

Security: By default, netdata listens on all interfaces. Restrict access via firewall:

sudo ufw allow from 192.168.1.0/24 to any port 19999  # local network only

Or configure authentication in /etc/netdata/netdata.conf.

Step 5: Viewing Logs in Real Time

Although not classic "monitoring," log tracking is critically important.

journalctl (systemd systems)

# Show logs from the last 10 minutes
journalctl --since "10 minutes ago"

# Follow new entries (like tail -f)
journalctl -f

# Logs for a specific unit (service)
journalctl -u nginx.service

lnav — smart log viewer

lnav highlights errors, allows filtering, and searches by format.

Installation:

sudo apt install lnav  # Ubuntu
sudo dnf install lnav  # CentOS

Usage:

sudo lnav /var/log/syslog

Keys:

• :filter-in <text> — show only lines with text.
• :filter-out <text> — hide lines with text.
• F7 — previous file in directory (useful for log rotation).

Verification

After completing the steps, you should be able to:

1. Launch htop and identify processes consuming the most CPU/RAM.
2. Use iostat to check if disks are overloaded (%util > 80%).
3. Use nethogs to find a process generating unexpected network traffic.
4. Open the netdata web interface and read graphs for the last hour.
5. Follow logs via journalctl -f and filter them with lnav.

Success criteria: You can promptly answer questions like:

• "Why is the server slow?" → htop + iostat.
• "Who is eating the network?" → nethogs.
• "What happened during the outage?" → nmon (if recording was on) or journalctl.

Possible Issues

"Command not found" after installation

Sometimes after installing via apt, the command is only available after relogin or sourcing the shell. Try:

hash -r  # clear command cache

Or use the full path (/usr/bin/htop).

netdata does not start or web interface does not respond

1. Check service status:

   sudo systemctl status netdata
   

2. If the service is inactive, start it:

   sudo systemctl start netdata
   sudo systemctl enable netdata  # autostart
   

3. Ensure port 19999 is open:

   sudo ss -tulpn | grep 19999
   

iostat shows 0% util, but disk is slow

This could be related to caching. Use the -x option for extended statistics and look at await. Also check:

• RAID status (if any) via cat /proc/mdstat.
• Disk SMART status: sudo smartctl -a /dev/sda.

nethogs requires root, but I don't have privileges

If you are not root, ask your administrator to add your user to the sudo group or install nethogs with setuid (not recommended for security reasons). Alternatively, use ss + lsof to track connections, but this is less直观.